CVE-2016-7166 libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip....
MediumCVSS 5.5
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libarchive(Debian:12) | < 3.2.0-2 | 3.2.0-2 |
| debian/libarchive(Debian:13) | < 3.2.0-2 | 3.2.0-2 |
| debian/libarchive(Debian:14) | < 3.2.0-2 | 3.2.0-2 |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux hpc node | = 7.0 | No fix listed |
| redhat enterprise linux hpc node | = 6.0 | No fix listed |
| redhat enterprise linux hpc node eus | = 7.2 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server aus | = 7.2 | No fix listed |
| redhat enterprise linux server eus | = 7.2 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| libarchive | <= 3.1.901a | No fix listed |
| oracle linux | = 6 | No fix listed |
| oracle linux | = 7 | No fix listed |
References
- Debian Security Tracker CVE-2016-7166 vendor-advisory
- RHSA-2016:1844 third-party-advisory vendor-advisory
- RHSA-2016:1850 third-party-advisory vendor-advisory
- [oss-security] 20160908 CVE request: libarchive (pre 3.2.0) denial of service with gzip quine mailing-list third-party-advisory
- [oss-security] 20160908 Re: CVE request: libarchive (pre 3.2.0) denial of service with gzip quine mailing-list third-party-advisory
- www.oracle.com third-party-advisory
- 92901 third-party-advisory vdb-entry
- bugs.freebsd.org issue-tracking
- bugzilla.redhat.com issue-tracking
- github.com issue-tracking patch
- github.com issue-tracking patch third-party-advisory
- GLSA-201701-03 vendor-advisory